tapimo 0.5.0 → 0.5.1

package/src/apps/data/routes/funding.ts

@@ -8,6 +8,7 @@ import * as FundingQuotes from '../../../internal/FundingQuotes.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
+import * as FundingQuoteProviders from '../FundingQuoteProviders.js'
 
 /** Zod schemas owned by funding quote resources. */
 export namespace schema {
@@ -15,7 +16,7 @@ export namespace schema {
   export const Chain = Schema.describe(
     z.object({
       addressFormat: z
-        .literal('evm')
+        .enum(['base58', 'base58check', 'evm'])
         .check(
           z.describe('Address family used by accounts and token identifiers on this chain.'),
           z.meta({ examples: ['evm'] }),
@@ -24,12 +25,12 @@ export namespace schema {
         .string()
         .check(
           z.describe(
-            'Stable CAIP-2 chain id, represented as a string instead of the numeric `chainId` used elsewhere.',
+            'Stable chain id. Uses CAIP-2 where standardized and a Tempo-defined compatible id otherwise.',
           ),
           z.meta({ examples: ['eip155:8453'] }),
         ),
       kind: z
-        .literal('evm')
+        .enum(['evm', 'solana', 'tron'])
         .check(
           z.describe('Chain execution family used for provider routing.'),
           z.meta({ examples: ['evm'] }),
@@ -41,7 +42,7 @@ export namespace schema {
         .optional(z.record(z.string(), z.string()))
         .check(
           z.describe('Provider-specific chain ids Tempo uses when requesting quotes.'),
-          z.meta({ examples: [{ relay: '8453' }] }),
+          z.meta({ examples: [{ across: '8453', relay: '8453', rhino: 'BASE' }] }),
         ),
     }),
     'A normalized chain reference for funding quotes.',
@@ -117,7 +118,7 @@ export namespace schema {
   export const ProviderRef = Schema.describe(
     z.object({
       id: z
-        .literal('relay')
+        .enum(['across', 'relay', 'rhino'])
         .check(z.describe('Stable provider id.'), z.meta({ examples: ['relay'] })),
       kind: z
         .string()
@@ -172,6 +173,12 @@ export namespace schema {
   /** Provider-derived output, limits, and freshness data. */
   export const QuoteDetails = Schema.describe(
     z.object({
+      expiresAt: z
+        .optional(z.iso.datetime())
+        .check(
+          z.describe('Timestamp after which the provider quote is no longer valid.'),
+          z.meta({ examples: ['2026-01-01T00:01:00Z'] }),
+        ),
       inputAmount: Schema.DecimalString.check(
         z.describe('Source amount sent to the provider in base units.'),
         z.meta({ examples: ['1000000'] }),
@@ -230,7 +237,7 @@ export namespace schema {
   export const Provider = Schema.describe(
     z.object({
       id: z
-        .literal('relay')
+        .enum(['across', 'relay', 'rhino'])
         .check(z.describe('Stable provider id.'), z.meta({ examples: ['relay'] })),
       kind: z
         .string()
@@ -278,10 +285,10 @@ export namespace schema {
             z.meta({ examples: ['USDC.e'] }),
           ),
         provider: z
-          .optional(z.literal('relay'))
+          .optional(z.enum(['across', 'relay', 'rhino']))
           .check(
             z.describe(
-              'Only request a quote from this provider. The supported id is `relay`; omit it to query every configured provider.',
+              'Only request a quote from this provider. Supported ids are `across`, `relay`, and `rhino`; omit it to query every configured provider.',
             ),
             z.meta({ examples: ['relay'] }),
           ),
@@ -304,7 +311,9 @@ export namespace schema {
           .string()
           .check(
             z.minLength(1),
-            z.describe('Source chain alias or CAIP-2 id, such as `base` or `eip155:8453`.'),
+            z.describe(
+              'Source chain alias or stable id, such as `base`, `solana`, or `eip155:8453`.',
+            ),
             z.meta({ examples: ['base', 'eip155:8453'] }),
           ),
         sourceToken: z
@@ -312,7 +321,7 @@ export namespace schema {
           .check(
             z.minLength(1),
             z.describe(
-              'Source token symbol, contract address, or Tempo token key. Symbol and address lookup is scoped to `sourceChain` and case-insensitive. An unknown token returns an empty list.',
+              'Source token symbol, contract address, or Tempo token key. Lookup is scoped to `sourceChain`; non-EVM addresses are case-sensitive. An unknown token returns an empty list.',
             ),
             z.meta({ examples: ['USDC', '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'] }),
           ),
@@ -414,7 +423,8 @@ export function funding(options: funding.Options = {}) {
             400: { codes: ['query_invalid'] },
             502: {
               codes: ['upstream_error'],
-              description: 'Every matching quote provider failed unexpectedly.',
+              description:
+                'No quote succeeded and at least one matching provider failed unexpectedly.',
             },
           },
           success: {
@@ -456,12 +466,17 @@ export function funding(options: funding.Options = {}) {
         } catch (cause) {
           const message = requestErrorMessage(cause)
           if (message) return Response.error(c, { code: 'query_invalid', message, status: 400 })
-          if (cause instanceof FundingQuotes.ProviderQuoteError)
+          if (cause instanceof FundingQuotes.ProviderQuoteError) {
+            const failures = cause.failures.map(FundingQuoteProviders.providerFailure)
+            const failure = failures[0]
+            if (failure) c.set('providerFailure', failure)
+            if (failures.length > 1) c.set('providerFailures', failures)
             return Response.error(c, {
               code: 'upstream_error',
               message: 'Quote providers could not complete the request.',
               status: 502,
             })
+          }
           throw cause
         }
       },

package/src/apps/data/routes/indexer.test.ts

@@ -1,11 +1,12 @@
 import { Challenge } from 'mppx'
 import { sessionManager } from 'mppx/client'
-import { RateLimit, Store } from 'tapimo'
+import { ZoneRpcAuthentication } from 'ox/tempo'
 import { Actions } from 'viem/tempo'
 import * as TestApp from '../../../../test/App.js'
 import * as Mppx from '../../../../test/Mppx.js'
 import * as Runtime from '../../../../test/runtime.js'
 import * as Tempo from '../../../../test/Tempo.js'
+import * as Auth from '../../../internal/Auth.js'
 import * as Tidx from '../../../internal/Tidx.js'
 import * as Viem from '../../../internal/Viem.js'
 import * as Indexer from './indexer.js'
@@ -83,13 +84,52 @@ describe('GET /indexer/query', () => {
       })
       const response = await client.v1.indexer.query.$get(
         { query: { chainId: String(zone), sql: 'select 1' } },
-        { headers: { authorization: `Bearer ${zoneReader.token}` } },
+        {
+          headers: {
+            authorization: `Bearer ${zoneReader.token}`,
+            [ZoneRpcAuthentication.headerName]: 'zone-rpc-secret',
+          },
+        },
       )
       const upstream = fetch.mock.calls[0]![0] as Request
 
       expect(response.status).toBe(200)
       expect(new URL(upstream.url).origin).toBe('https://zone.tidx.test')
       expect(upstream.headers.get('authorization')).toBe('Basic em9uZS1zZWNyZXQ=')
+      expect(upstream.headers.get(ZoneRpcAuthentication.headerName)).toBeNull()
+    } finally {
+      fetch.mockRestore()
+    }
+  })
+
+  test('routes Zone queries to the Zone TIDX with its bearer auth', async () => {
+    const zone = runtime.zone.chainId
+    const zoneReader = {
+      id: 'key_zone_bearer_indexer',
+      orgId: 'org_test',
+      scopes: ['data:read', 'indexer:query', `zone:${zone}:read`],
+      token: 'secret_zone_bearer_indexer',
+    } satisfies TestApp.kvStore.Key
+    const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ columns: [], ok: true, row_count: 0, rows: [] }), {
+        headers: { 'content-type': 'application/json' },
+      }),
+    )
+    try {
+      const client = TestApp.client({
+        auth: { keys: [zoneReader] },
+        tidx: { baseUrl: 'https://zone.tidx.test', bearerAuth: 'zone-secret' },
+        zones: [{ chainId: zone, forwardRpcUrl: runtime.zone.forwardRpcUrl }],
+      })
+      const response = await client.v1.indexer.query.$get(
+        { query: { chainId: String(zone), sql: 'select 1' } },
+        { headers: { authorization: `Bearer ${zoneReader.token}` } },
+      )
+      const upstream = fetch.mock.calls[0]![0] as Request
+
+      expect(response.status).toBe(200)
+      expect(new URL(upstream.url).origin).toBe('https://zone.tidx.test')
+      expect(upstream.headers.get('authorization')).toBe('Bearer zone-secret')
     } finally {
       fetch.mockRestore()
     }
@@ -156,6 +196,20 @@ describe('GET /indexer/query', () => {
     expect(response.status).toMatchInlineSnapshot(`401`)
   })
 
+  test('does not expose anonymous access', () => {
+    expect(Auth.describeAccess(Indexer.indexer())['indexerQuery']).toMatchInlineSnapshot(`
+      {
+        "apiKey": true,
+        "mpp": true,
+        "public": false,
+        "scopes": [
+          "indexer:query",
+        ],
+        "session": false,
+      }
+    `)
+  })
+
   test('proxies without auth middleware', async () => {
     const client = TestApp.client({ auth: false })
     const response = await client.v1.indexer.query.$get({
@@ -167,10 +221,8 @@ describe('GET /indexer/query', () => {
     expect(body.ok).toMatchInlineSnapshot(`true`)
   })
 
-  test('completes the MPP payment lifecycle when public quota is exhausted', async () => {
-    const rateLimitStore = Store.memory()
+  test('challenges anonymous callers for MPP payment', async () => {
     const app = TestApp.create({
-      rateLimit: { store: rateLimitStore },
       mpp: {
         secretKey: 'secret_test_key_0123456789abcdef',
         session: {
@@ -182,13 +234,9 @@ describe('GET /indexer/query', () => {
         },
       },
     })
-    await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {
-      perMinute: 60,
-    })
 
-    // An unpaid over-quota request is challenged for payment. MPP challenges
-    // and receipts ride on real HTTP headers, so we drive the lifecycle
-    // through `app.fetch` rather than the typed route client.
+    // MPP challenges and receipts ride on real HTTP headers, so drive the
+    // lifecycle through `app.fetch` rather than the typed route client.
     const challenge = await app.fetch(
       new Request('http://tempo-api.test/v1/indexer/query?sql=select%201'),
     )
@@ -209,10 +257,31 @@ describe('GET /indexer/query', () => {
     expect(body.ok).toMatchInlineSnapshot(`true`)
   })
 
+  test('rejects an unsupported chain before issuing an MPP challenge', async () => {
+    const app = TestApp.create({
+      mpp: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
+          chainId: Tempo.chain.id,
+          currency: Tempo.currency,
+          decimals: 6,
+          getClient: () => Tempo.client,
+          recipient: Tempo.accounts[2].address,
+        },
+      },
+    })
+    const response = await app.fetch(
+      new Request('http://tempo-api.test/v1/indexer/query?sql=select%201&chainId=31318'),
+    )
+    const body = (await response.json()) as { error: { code: string } }
+
+    expect(response.status).toBe(400)
+    expect(response.headers.has('www-authenticate')).toBe(false)
+    expect(body.error.code).toBe('chain_id_unsupported')
+  })
+
   test('accepts session management POSTs', { timeout: 120_000 }, async () => {
-    const rateLimitStore = Store.memory()
     const app = TestApp.create({
-      rateLimit: { store: rateLimitStore },
       mpp: {
         secretKey: 'secret_test_key_0123456789abcdef',
         session: {
@@ -225,9 +294,6 @@ describe('GET /indexer/query', () => {
         },
       },
     })
-    await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {
-      perMinute: 60,
-    })
     await Actions.faucet.fundSync(Tempo.client, {
       account: Tempo.accounts[2],
       timeout: 60_000,
@@ -264,7 +330,3 @@ describe('GET /indexer/query', () => {
     expect(state.deposit).toMatchInlineSnapshot(`0n`)
   })
 })
-
-async function exhaustQuota(rateLimit: RateLimit.Store, key: string, limit: RateLimit.Limit) {
-  for (let index = 0; index < limit.perMinute; index++) await rateLimit.consume({ key, limit })
-}

package/src/apps/data/routes/indexer.ts

@@ -1,4 +1,5 @@
 import { Hono, type Context, type TypedResponse } from 'hono'
+import { ZoneRpcAuthentication } from 'ox/tempo'
 import * as z from 'zod/mini'
 
 import type * as App from '../../../App.js'
@@ -25,6 +26,7 @@ const strippedHeaders = new Set([
   'transfer-encoding',
   'upgrade',
   'tempo-api-key',
+  ZoneRpcAuthentication.headerName.toLowerCase(),
 ])
 
 /** Never reached; carries typed passthrough response variants into Hono client inference. */
@@ -99,7 +101,7 @@ export function indexer() {
 
   return new Hono<App.Environment>().get(
     '/v1/indexer/query',
-    Auth.policy({ apiKey: { scopes: ['indexer:query'] }, mpp: true, public: true }),
+    Auth.policy({ apiKey: { scopes: ['indexer:query'] }, mpp: true }),
     OpenApi.describeRoute({
       description:
         'Runs a read-only SQL-style query against Tempo’s indexed chain data, with optional live streaming as new blocks arrive.',
@@ -256,7 +258,10 @@ async function passthrough(
   // Resolve the upstream for this caller. A resolver `tidx` can route by
   // principal (e.g. anonymous `type: 'public'` callers to a public, no-auth
   // indexer); a static config ignores the principal.
-  const { baseUrl, basicAuth } = Tidx.resolve(tidx, { chainId, principal: Auth.getPrincipal(c) })
+  const { baseUrl, basicAuth, bearerAuth } = Tidx.resolve(tidx, {
+    chainId,
+    principal: Auth.getPrincipal(c),
+  })
   // The chain id is syntactically valid but this deployment has no indexer
   // upstream configured for it (no `tidx` config and no built-in default).
   if (!baseUrl)
@@ -290,6 +295,7 @@ async function passthrough(
   for (const [name, value] of c.req.raw.headers)
     if (!strippedHeaders.has(name.toLowerCase())) headers.set(name, value)
   if (basicAuth) headers.set('authorization', `Basic ${btoa(basicAuth)}`)
+  else if (bearerAuth) headers.set('authorization', `Bearer ${bearerAuth}`)
 
   const method = c.req.method
 

package/src/apps/management/Billing.test.ts

@@ -1,7 +1,7 @@
 import { nanoid } from 'nanoid'
 import type Stripe from 'stripe'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as ApiKeys from '../../ApiKeys.js'
 import * as Db from '../../db/Db.js'
 import * as RequestUsage from '../../db/tables/requestUsage.js'
@@ -11,7 +11,7 @@ import * as Store from '../../internal/Store.js'
 import * as Viem from '../../internal/Viem.js'
 import * as Billing from './Billing.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Baseline billable mainnet sponsorship input; tests override per case. */
 const input = {

package/src/apps/mcp.test.ts

@@ -269,3 +269,21 @@ test('documents POST /mcp and keeps it open under auth enforcement', async () =>
   )
   expect(rejected.status).toBe(401)
 })
+
+test('applies the MCP anonymous rate limit', async () => {
+  const app = TestApp.create()
+  app.route('/', mcp({ docs: false, fetch: (request) => app.fetch(request) }))
+
+  const response = await app.fetch(
+    new Request(new URL('/mcp', origin), {
+      body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'tools/list', params: {} }),
+      headers: {
+        accept: 'application/json, text/event-stream',
+        'content-type': 'application/json',
+      },
+      method: 'POST',
+    }),
+  )
+
+  expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"100"`)
+})

package/src/apps/mcp.ts

@@ -125,10 +125,10 @@ export function mcp(options: mcp.Options) {
   const app = new Hono<App.Environment>()
     .post(
       '/mcp',
-      Auth.policy({ apiKey: { scopes: [] }, public: true }),
+      Auth.policy({ apiKey: { scopes: [] }, public: { rateLimit: { perMinute: 100 } } }),
       OpenApi.describeRoute({
         description:
-          "A stateless streamable-HTTP MCP server: send JSON-RPC 2.0 messages as `POST` with `Accept: application/json, text/event-stream`. Tools mirror the API's data domain, plus `docs_*` documentation search. Anonymous requests use the public quota; send `Authorization: Bearer <api key>` for protected tools.",
+          "A stateless streamable-HTTP MCP server: send JSON-RPC 2.0 messages as `POST` with `Accept: application/json, text/event-stream`. Tools mirror the API's data domain, plus `docs_*` documentation search. Anonymous requests allow 100 requests per minute; send `Authorization: Bearer <api key>` for protected tools.",
         operationId: 'mcpRequest',
         // The JSON-RPC request envelope is protocol-owned (like `/rpc`), so the
         // body documents an example rather than a schema.

package/src/apps/relay/App.test.ts

@@ -450,7 +450,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
       `)
   })
 
-  test('behavior: production keys record billable rows', async () => {
+  test('behavior: non-mainnet production keys record billable rows', async () => {
     const db = TestApp.database()
     const app = TestApp.create({
       auth: { keys },
@@ -1141,15 +1141,15 @@ describe.runIf(TestStripe.secretKey)(
   () => {
     // prettier-ignore
     const webhookSecret = `whsec_${'c'.repeat(32)}`
-    let node: Awaited<ReturnType<typeof Containers.startTempo>> | undefined
+    let node: Awaited<ReturnType<typeof Containers.tempo>> | undefined
 
     beforeAll(async () => {
-      node = await Containers.startTempo({ chainId: Viem.chainId.mainnet })
+      node = await Containers.tempo({ chainId: Viem.chainId.mainnet })
     }, 240_000)
 
     afterAll(async () => {
       await TestStripe.sweep()
-      await node?.container.stop()
+      await node?.stop()
     })
 
     test(
@@ -1157,7 +1157,8 @@ describe.runIf(TestStripe.secretKey)(
       { retry: 0, timeout: 300_000 },
       async () => {
         // prettier-ignore
-        const { url } = node!
+        const endpoint = node!.endpoints.default
+        const url = `http://${endpoint.host}:${endpoint.port}`
         const stripe = TestStripe.client()
         const db = TestApp.database()
         // The key attributes to org_1; the row must exist for the usage read.

package/src/apps/relay/App.ts

@@ -20,8 +20,8 @@ import * as Scope from '../../Scope.js'
 
 /**
  * The relay route group exposes wallet features at `/rpc/relay` and fee
- * sponsorship at `/rpc/sponsor`. Mount it after `data()`, which publishes
- * chain clients and supported chains.
+ * sponsorship at `/rpc/sponsor`. Mount it after `data()`, which publishes the
+ * verified-token and zone context used by relay handlers.
  *
  * ```ts
  * App.create(options).route('/', data()).route('/', relay())

package/src/apps/relay/Sponsorships.test.ts

@@ -2,12 +2,12 @@ import { nanoid } from 'nanoid'
 import { TxEnvelopeTempo } from 'ox/tempo'
 import type { Client } from 'viem'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../../db/Db.js'
 import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
 import * as Sponsorships from './Sponsorships.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Baseline insert input; tests override per case. */
 const input = {

package/src/db/Db.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../test/containers.js'
+import * as Runtime from '../../test/runtime.js'
 import * as Db from './Db.js'
 import * as Organizations from './tables/organizations.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 describe('postgres', () => {
   test('behavior: migrate is idempotent', async () => {
@@ -16,7 +16,7 @@ describe('postgres', () => {
   })
 
   test('behavior: creates a Postgres db without schema scoping', async () => {
-    const db = Db.postgres({ connectionString: postgresUrl })
+    const db = Db.postgres({ connectionString: Runtime.postgresUrl })
     await db.close()
   })
 
@@ -24,14 +24,14 @@ describe('postgres', () => {
     const schema = `t_${nanoid()}`
     // Pre-create the schema so concurrent migrate races only on the
     // `migrations` ledger, not `CREATE SCHEMA`.
-    const seed = Db.postgres({ connectionString: postgresUrl, schema })
+    const seed = Db.postgres({ connectionString: Runtime.postgresUrl, schema })
     await Organizations.get(seed, 'x').catch(() => {})
     await seed.close()
 
     // Several runners migrate the same fresh schema at once (mirrors parallel
     // deploys). The session advisory lock serializes them; none throw.
     const dbs = Array.from({ length: 5 }, () =>
-      Db.postgres({ connectionString: postgresUrl, schema }),
+      Db.postgres({ connectionString: Runtime.postgresUrl, schema }),
     )
     await Promise.all(dbs.map((db) => db.migrate()))
     const created = await Organizations.create(dbs[0]!, { id: 'org_race', name: 'Race' })

package/src/db/tables/billingSettings.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../Db.js'
 import * as BillingSettings from './billingSettings.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Redacts nondeterministic row fields (timestamps). */
 function redact(record: BillingSettings.Record) {

package/src/db/tables/organizations.test.ts

@@ -1,11 +1,11 @@
 import { nanoid } from 'nanoid'
 
+import * as Runtime from '../../../test/runtime.js'
 import * as Webhooks from '../../internal/Webhooks.js'
 import * as Db from '../Db.js'
 import * as Organizations from './organizations.js'
-import { postgresUrl } from '../../../test/containers.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Redacts nondeterministic row fields (generated nanoid ids, timestamps). */
 function redact(record: Organizations.Record) {

package/src/db/tables/sponsoredTransactions.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../Db.js'
 import * as SponsoredTransactions from './sponsoredTransactions.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Baseline insert input; tests override per case. */
 const input = {
@@ -95,6 +95,23 @@ describe('upsert', () => {
     await db.close()
   })
 
+  test('behavior: rejects a sign payload already attributed to another org', async () => {
+    const db = create()
+    await db.migrate()
+    const first = await SponsoredTransactions.upsert(db, input)
+
+    await expect(
+      SponsoredTransactions.upsert(db, {
+        ...input,
+        orgId: 'org_2',
+        transactionHash: `0x${'dd'.repeat(32)}`,
+      }),
+    ).rejects.toThrow()
+
+    expect(await SponsoredTransactions.get(db, first.id)).toStrictEqual(first)
+    await db.close()
+  })
+
   test('behavior: a raw submission reopens a failed fill intent', async () => {
     const db = create()
     await db.migrate()

package/src/db/tables/sponsoredTransactions.ts

@@ -47,20 +47,27 @@ export async function upsert(db: Db.Db, input: upsert.Input): Promise<Record> {
     .insertInto('sponsored_transactions')
     .values(record)
     .onConflict((oc) =>
-      oc.column('signPayload').doUpdateSet((eb) => ({
-        // Same sign payload = same envelope = same cap; only fills older nulls.
-        currency: eb.fn.coalesce(eb.ref('sponsored_transactions.currency'), eb.ref('excluded.currency')), // prettier-ignore
-        feeMax: eb.fn.coalesce(eb.ref('sponsored_transactions.feeMax'), eb.ref('excluded.feeMax')),
-        // A raw submission fills the intent's hash; a duplicate intent never
-        // clears an already-known hash.
-        transactionHash: eb.fn.coalesce(
-          eb.ref('excluded.transactionHash'),
-          eb.ref('sponsored_transactions.transactionHash'),
-        ),
-        createdAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN ${eb.ref('excluded.createdAt')} ELSE ${eb.ref('sponsored_transactions.createdAt')} END`,
-        finalizedAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN NULL ELSE ${eb.ref('sponsored_transactions.finalizedAt')} END`,
-        status: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN 'pending' ELSE ${eb.ref('sponsored_transactions.status')} END`,
-      })),
+      oc
+        .column('signPayload')
+        .doUpdateSet((eb) => ({
+          // Same sign payload = same envelope = same cap; only fills older nulls.
+          currency: eb.fn.coalesce(eb.ref('sponsored_transactions.currency'), eb.ref('excluded.currency')), // prettier-ignore
+          feeMax: eb.fn.coalesce(
+            eb.ref('sponsored_transactions.feeMax'),
+            eb.ref('excluded.feeMax'),
+          ),
+          // A raw submission fills the intent's hash; a duplicate intent never
+          // clears an already-known hash.
+          transactionHash: eb.fn.coalesce(
+            eb.ref('excluded.transactionHash'),
+            eb.ref('sponsored_transactions.transactionHash'),
+          ),
+          createdAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN ${eb.ref('excluded.createdAt')} ELSE ${eb.ref('sponsored_transactions.createdAt')} END`,
+          finalizedAt: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN NULL ELSE ${eb.ref('sponsored_transactions.finalizedAt')} END`,
+          status: sql`CASE WHEN ${eb.ref('sponsored_transactions.status')} = 'failed' THEN 'pending' ELSE ${eb.ref('sponsored_transactions.status')} END`,
+        }))
+        // A shared envelope cannot transfer billing attribution across tenants.
+        .where('sponsored_transactions.orgId', '=', input.orgId),
     )
     .returningAll()
     .executeTakeFirstOrThrow()

package/src/db/tables/stripeCustomers.test.ts

@@ -1,10 +1,10 @@
 import { nanoid } from 'nanoid'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as Db from '../Db.js'
 import * as StripeCustomers from './stripeCustomers.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Redacts nondeterministic row fields (timestamps). */
 function redact(record: StripeCustomers.Record) {

package/src/internal/Auth.ts

@@ -1406,6 +1406,16 @@ export function require<environment extends Environment = Environment>(
     const hasQueryApiKey = new URL(c.req.url).searchParams.has('key')
     // Auth owns `key`; strict route schemas must not validate it.
     stripApiKeyQuery(c)
+    // Reject unknown chains before MPP builds a chain-bound challenge. Route
+    // groups publish their supported chains into the shared app context.
+    const chainId = explicitChainId(c)
+    const supportedChainIds = (c.var as Record<string, unknown>)['supportedChainIds']
+    if (
+      chainId !== undefined &&
+      supportedChainIds instanceof Set &&
+      !supportedChainIds.has(chainId)
+    )
+      return Response.unsupportedChainId(c, chainId, supportedChainIds)
     const proceed = async () => {
       await next()
       // Query credential responses must not enter shared caches.